coincommuities[.]org

This domain, coincommuities.org, is identified as a high-risk phishing infrastructure targeting cryptocurrency users by impersonating legitimate community or wallet service platforms. Analysis indicates the site employs generic phishing tactics, likely designed to harvest wallet credentials or deploy drainer kits to siphon digital assets. The domain mimics trusted crypto community forums or support channels, exploiting user trust to facilitate unauthorized transactions or credential theft. Infrastructure analysis reveals the domain was registered on June 07, 2026, through Web Commerce Communications Limited dba WebNic.cc. It resolves to the IP address 109.107.168.21, hosted under AS200823 MHost LLC in Germany. Security vendor detections on VirusTotal report 8 out of 95 engines flagging the domain as malicious. The domain appears on four distinct security blocklists, and its SSL certificate is issued by Let's Encrypt (YR1). Despite its recent registration, the site remains active and unlisted by Google Safe Browsing at the time of this report. Current status confirms the domain is still operational, with no evidence of takedown or mitigation efforts. Response actions by security entities include blocking by multiple wallet protection tools and phishing detection systems. The remaining risk is classified as high due to the domain's active status, low detection rate relative to its malicious intent, and its targeting of cryptocurrency users. Users are advised to avoid interaction with the domain, verify wallet addresses independently, and employ hardware or multi-factor authentication for asset protection. Organizations should update blocklists to include this domain and monitor for associated IP or certificate reuse in future campaigns.